Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I currently have a Windows Server 2003 setup to serve multiple sites via IIS. One of our directories needs to allow access to only 1 specific AD Security Group.

I know there are two ways to accomplish this. One is using IIS to add permissions and the other is to set permissions on the folder/directory itself. A script runs at night and populates the content so users only need read permissions to view it in a browser.

My question is which one is preferred?

share|improve this question

migrated from webmasters.stackexchange.com Dec 29 '10 at 15:16

This question came from our site for pro webmasters.

add comment

1 Answer 1

up vote 1 down vote accepted

I would do both. Turn off the anonymous user for the IIS website, and also lock down NTFS permissions to just the AD group + administrators + SYSTEM + the app pool user.

btw, the right-click permissions in IIS on the site level is the same NTFS permissions as if you do it from Windows Explorer directly. It's just a shortcut to the same folder/file security settings.

share|improve this answer
    
Thanks for the help Scott. –  jason.dot.h Jan 29 '11 at 18:37
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.